Generic Side-channel attacks on CCA-secure lattice-based PKE and KEM schemes
Generic Side-channel attacks on CCA-secure lattice-based PKE and KEM schemes
复制标题
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
P. Ravi;S. Roy;A. Chattopadhyay;S. Bhasin
中科院分区：
文献类型：
--
作者：
P. Ravi;S. Roy;A. Chattopadhyay;S. Bhasin
在这篇文章中，我们展示了实际的侧信道辅助选择密文攻击（CCA）在多个CCA安全的基于格的公钥加密方案（PKE）和密钥封装机制（KEM）。大多数基于格的PKE/KEM都存在解密失败的问题，其中一些方案使用前向纠错码来降低失败概率。这些纠错码在用于公钥加密方案中时，涉及具有秘密分量的计算，因此可能泄漏敏感的侧信道信息。在这项工作中，我们确定了恒定时间纠错码的侧信道漏洞，这有助于攻击者通过EM/功率侧信道信息区分错误和有效码字。我们利用该漏洞演示了一个实际的选择密文攻击的CCA安全的Round 5算法，使用时间攻击的抗纠错码。我们进一步确定了一个通用的边信道漏洞内的CCA转换步骤中使用的多个CCA安全的基于格的PKE/KEM计划。利用该漏洞，我们证明了一个实际的chosenciphertext攻击，可以在多个CCA安全latticebased PKE/KEM计划。我们使用从pqm 4库中获取的多个NIST候选者的优化实现中观察到的电磁测量对我们的攻击进行实验验证，pqm 4库是ARM Cortex-M4微控制器后量子加密实现的基准框架。因此，我们确定：（1）使用纠错码的基于格的方案，无论是否是恒定时间的，都容易受到功率/EM侧信道攻击;（2）CCA安全方案与CPA安全版本一样不安全的概念，除非适当地屏蔽侧信道攻击。
In this article, we demonstrate practical side-channel assisted chosen-ciphertext attacks (CCA) over multiple CCA-secure lattice-based public-key encryption schemes (PKE) and key-encapsulation mechanisms (KEM). Most lattice-based PKE/KEMs suffer from the problem of decryption failures and some of these schemes use forward error correction codes to reduce the failure probability. These error correcting codes, when used within public-key cryptographic schemes, involve computations with secret components and hence might leak sensitive side-channel information. In this work, we identify a side-channel vulnerability in constant-time error correcting codes, which help the attacker distinguish between faulty and valid codewords through the EM/power side-channel information. We exploit the vulnerability to demonstrate a practical chosen-ciphertext attacks on the CCA-secure Round5 algorithm which uses timing attack resistant error correcting code. We further identify a generic side-channel vulnerability within the CCA transformation steps used in multiple CCA-secure lattice-based PKE/KEM schemes. Exploiting the vulnerability, we demonstrate a practical chosenciphertext attack which can be performed on multiple CCA-secure latticebased PKE/KEM schemes. We perform experimental validation of our attacks using Electromagnetic measurements observed over optimized implementations of multiple NIST candidates taken from the pqm4 library, a benchmarking framework for post quantum cryptographic implementations for the ARM Cortex-M4 microcontroller. We thus establish that (1) lattice-based schemes that use error correcting codes, no matter constant-time or not, are vulnerable to power/EM side-channel attacks and (2) the notion that CCA-secure schemes are as insecure as their CPA-secure versions unless suitably masked against side-channel attacks.